The console

With TESSARIDB_S3_CONSOLE_LISTEN set, the node also serves the operator console on an address apart from the S3 API. The page loads nothing from the network (no font, no script from anywhere else) and runs only its own script under a strict content security policy. Everything it does goes through the JSON API under /api/v1, which can be called directly.

Signing in

Signing in takes an access key and its secret (the root key or a key issued to a user) and gives a one-hour session cookie (HttpOnly, SameSite=Strict). Sign-ins are limited per client address (TESSARIDB_S3_CONSOLE_SIGN_INS_PER_MINUTE, 10) and requests per signed-in key (TESSARIDB_S3_CONSOLE_REQUESTS_PER_MINUTE, 600).

With an OpenID Connect provider (TESSARIDB_S3_CONSOLE_OIDC_*) a person signs in at /api/v1/auth/oidc/start: authorization code with PKCE (S256), the console server holding every token and the browser only its session cookie. The ID token is checked against the provider's published keys with a fixed algorithm list, and a second factor is required through amr. The identity must be linked to a user (PUT /api/v1/users/{user}/identity), and the link is recorded.

• Break-glass. Beside a provider, signing in with the root key is the emergency path: it owes a reason, lasts 15 minutes, is recorded before the session exists, and is announced to TESSARIDB_S3_CONSOLE_BREAK_GLASS_WEBHOOK when one is set.
• Provider-only. TESSARIDB_S3_CONSOLE_KEY_SIGN_IN=root refuses users' keys for the console (key_sign_in_disabled); the S3 API is not affected.
• Recent sign-in. Issuing a key or an upload key, linking an identity, setting or removing a grant, setting a quota and deleting a bucket are refused with 401 reauthentication_required when the operator last authenticated more than five minutes ago.
• Logout. A session ends at its next request when the user is disabled, the identity is unlinked, or the provider posts a back-channel logout to /api/v1/auth/oidc/backchannel-logout.

What it shows and does

• Overview: this node's data drive and, on a cluster member, its members, whether each answers, their zones and drives, and how many objects wait for healing.
• Buckets: objects and bytes per bucket as of the last usage measurement (GET /api/v1/usage), logical and on the drives with erasure overhead; create and delete; quotas; media rules; upload keys for one object.
• Objects: a bucket a page at a time by the server's cursor, a name filter that lists a longer prefix, each key's headers, metadata and checksums read from its record; downloads always as attachments; deletes under the ETag the operator saw, so a changed object answers 412 and is kept.
• Users and keys: spaces and users, keys shown once (issuing is idempotent), keys listed without secrets and revoked with a reason, bucket grants.
• Cluster: for keys allowed to see it, the sets, each node's zone, admission, one-time join tokens, removal, and staging and applying a layout.
• Renditions that failed for good, with their tries and last error.
• The action record (GET /api/v1/actions): every change and every download, with the signed-in key and the reason, newest first. It is kept a year in TessariDB, which refuses to change or remove an entry.

[!WARNING] Without TESSARIDB_S3_CONSOLE_TLS_CERT / _KEY, a secret crosses the network in the clear when an operator signs in. Keep the console on a private address or give it a certificate; the node says so when it starts.